IP Lookup: Where An Address Is, And Who Owns The Network

What an IP address can and cannot tell you

An address is not a location. It is an entry in a registry, and the registry says which organisation was allocated the block it belongs to. Everything beyond that — the city, the coordinates, the time zone — is inference: a database vendor correlating the allocation with routing data, with addresses their customers have reported, and with whatever the operator chose to publish.

Which means the accuracy is wildly uneven, and uneven in a way that is predictable. Country is usually right. City is a reasonable guess for a residential connection in a large country and a coin flip for a mobile one, where a single gateway can serve half a region. For a datacentre range it is often not a guess at all — there is no household to place, and the database says so by leaving the city blank.

The coordinates deserve a warning of their own. When a database cannot place an address precisely it returns the centre of the country, and those centroids are real places where real people live. The classic case was a farm in Kansas at the geographic centre of the United States, which for a decade received visits from people convinced it was the source of every untraceable thing on the internet. If the coordinates below look suspiciously round, that is what you are looking at.

Where this lookup gets its answer

From a MaxMind GeoLite2 database on our own server, on a private network, queried directly. The address you type is not forwarded to a third-party API, and it is not written down. Results are cached by address for a day, so asking the same question twice does not re-read the database, and that is the whole of it.

This matters more than it sounds. Most lookup pages are a thin front end over somebody else's commercial API, which means the address you are curious about — often a proxy you are evaluating, or an address that showed up in your logs — is handed to a company whose business is data. Ours goes nowhere.

The database is MaxMind's free GeoLite2 tier, which is the same data most of the industry's free lookups use. It is updated by hand here rather than on a schedule, so it is accurate to within a few weeks rather than to the hour. For the question people actually bring to this page — is this address where it claims to be, and who owns the network — a few weeks makes no difference.

Addresses it will refuse

Private ranges (10.x, 192.168.x, 172.16–31.x), loopback and link-local addresses are rejected before the lookup runs. They are not allocated to anyone: several hundred million machines share them, and a database entry for 192.168.1.1 would be a lie dressed as data. Both IPv4 and IPv6 work; a hostname does not, because resolving one is a different question with a different answer per resolver.

Checking a list of proxies with this

The usual reason to be on a page like this is that somebody has sold you a pool and you want to know what you got. A short routine that catches most of what matters:

1. Look up a handful at random, not the first five. The first addresses in an exported list are often the ones the seller checked.
2. Compare the ASNs. This is the single most useful check on this page. A "diverse residential pool" where every sample shares one ASN is one network wearing several addresses, and a site that blocks by ASN takes the whole pool in one action.
3. Watch for blank cities. A named organisation with no city is a datacentre range. One or two in a residential pool happens; a pattern of them means the listing was optimistic.
4. Check the country against what you are paying for. Geo-targeted pools are priced per country, and a pool sold as German with addresses registered elsewhere is the straightforward version of not getting what you paid for.
5. Then test them properly. Geolocation says where a database thinks an address is. It cannot say whether the endpoint answers, how fast, or whether it leaks your own address in the headers — that is what the proxy checker is for, and the two questions are worth asking in that order.

Together those five minutes tell you more about a provider than a review does, because they are about the addresses you were actually given rather than the ones in the marketing.

Reading the result as somebody buying proxies

This is where the ASN and the organisation earn their place on the page, and why they are worth more than the city for most of our readers.

• A blank city with a named organisation is the signature of a datacentre range. If you were told the proxy was residential, this is your answer, and no amount of country matching changes it.
• The organisation is a consumer ISP — a telecoms company with a household brand name — which is consistent with a residential address. Consistent, not proof: addresses leased from an ISP by a proxy operator still carry the ISP's name.
• The organisation is a hosting company or a name you have never heard of that turns out to sell servers. The address is in a datacentre whatever the listing said.
• The ASN is the thing to compare across a list. Fifty addresses in a "diverse residential pool" that all share one ASN are fifty addresses on one network, and sites that block by ASN will take all fifty at once.

If you want to know what an endpoint actually does rather than where it claims to be, the proxy checker connects to it and reports latency, the protocol it really speaks, and whether it passes your own address through in the headers. Geolocation says where a database thinks it is; the checker says whether it works.